Re: [libvirt] Investigation and possible fix of 1361592 - apparmor profiles do not include backing files

2018-08-17 Thread Peter Krempa
On Thu, Aug 16, 2018 at 23:03:40 +0300, Povilas Kanapickas wrote: > On 16/08/2018 10:38, Peter Krempa wrote: > > To fix this you should record the backing format [1] into your overlay > > image. If we'd relax the code we'd face the regression in the security > > fix we've done. > > > > [1]

Re: [libvirt] Investigation and possible fix of 1361592 - apparmor profiles do not include backing files

2018-08-16 Thread Povilas Kanapickas
On 16/08/2018 10:38, Peter Krempa wrote: > To fix this you should record the backing format [1] into your overlay > image. If we'd relax the code we'd face the regression in the security > fix we've done. > > [1] qemu-img creage -f qcow2 -F qcow2 -b backing-qcow2 overlay.qcow2 > > -F option

[libvirt] Investigation and possible fix of 1361592 - apparmor profiles do not include backing files

2018-08-16 Thread Povilas Kanapickas
Hi, I've looked into why apparmor profiles do not contain exceptions for backing files of images which later leads to permission errors due to apparmor containment. As of newest libvirt git master, only the first level backing image is included, the subsequent images are omitted. Below is my

Re: [libvirt] Investigation and possible fix of 1361592 - apparmor profiles do not include backing files

2018-08-16 Thread Peter Krempa
On Wed, Aug 15, 2018 at 20:56:35 +0300, Povilas Kanapickas wrote: > Hi, Hi, > > I've looked into why apparmor profiles do not contain exceptions for > backing files of images which later leads to permission errors due to > apparmor containment. As of newest libvirt git master, only the first >

[libvirt] Investigation and possible fix of 1361592 - apparmor profiles do not include backing files

2018-08-15 Thread Povilas Kanapickas
Hi, I've looked into why apparmor profiles do not contain exceptions for backing files of images which later leads to permission errors due to apparmor containment. As of newest libvirt git master, only the first level backing image is included, the subsequent images are omitted. Below is my